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Appendix A 
Marked Up Version of Entire Claim Set 

1 . (AMENDED) An interception method for performing a lawful interception in a 
packet network, comprising the steps of: 

providing a first network element [(LIN)] having an interception function for intercepting 
data packets; 

b) controlling said interception function by an interception control means [(26)] 
implemented in a second network element [(LIG)]; and 

c) transmitting an Intercepted data packet from said first network element [(LIN)] 
via said packet network to an interception gateway element [(LIG)] providing an 
interface to at least one intercepting authority [(LEA)]. 

2. (AMENDED) A method according to claim 1, wherein said interception 
gateway element [(LIG)] Is integrated in said second network element. 

3. (AMENDED) A method according to claim 1 [or 2], wherein a header of a data 
packet is read by said network element [(LIN)] and data packets to be intercepted 
are duplicated. 

4. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said intercepted data packet is transmitted to said Interception gateway 
element [(LIG)] using a secure tunnel. 
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5. A method according to claim 4, wherein said secure tunnel is implemented by 
an encryption processing. 

6. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said intercepted data packet is transmitted via interworking units [(IWU)] and 
encrypted between said Interworking units, when said first network element [(LIN)] and 
said interception gateway element [(LIG)] are arranged in separate network segments. 

7. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said first network element is provided in each network segment of said packet 
network. 

8. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein received intercepted data packets are collected in said interception gateway 
element [(LIG)] and supplied to an interface of said at least one intercepting authority 
[(LEA)]. 

9. A method according to claim 8, wherein said interface comprises a first 
interface for administrative tasks, a second Interface for network signaling, and a third 
interface for intercepted user data. 
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1 0. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said intercepting function comprises a packet sniffing and filtering function. 

11. A method according to claim 10, wherein said intercepting function is 
implemented in the Gn interface. 

1 2. (AlVIENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said interception function comprises reading data packets, analyzing the 
header of the data packets as to whether the data packet should be intercepted or not, 
and transmitting the data packet to said interception gateway element [(LIG)l, and a 
management function for interception and transmission criteria. 

1 3. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein an alarm is transmitted to said interception gateway element [(LIG)] and all 
interception information of a respective network element [(LIN)] is deleted, when a 
breakage of a casing of the respective network element has been detected. 

14. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein fake packets are transmitted from said network element [(LIN)] to said 
interception gateway element [(LIG)]. 

1 5. (AMENDED) A method according to claim 14, wherein said fake packets are 
transmitted at random or triggered at any passing packet, such that the total load of 
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intercepted and fake packets transmitted to said Interception gateway element [(LIG)] 
Is constant. 

16. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein said intercepted data packet is padded to a maximum length. 

1 7. (AMENDED) A method according to [any one of the preceding] claim[s] 1, 
wherein a time information is added to said intercepted data packet. 

18. (AMENDED) An interception system for performing a lawful interception in a 
packet network, comprising: 

a) a first network element [(LIN)] having an interception function for intercepting 
data packets and comprising a transmitting means [(14)] for transmitting an 
intercepted data packet to said packet network; 

b) an Interception control means [(26)] implemented in a second network element 
[(LIG)] and controlling the interception function; and 

c) an interception gateway element [(LIG)] having a receiving means [(21)] for 
receiving said intercepted data packet and an interface means [(27)] for providing an 
interface to at least one intercepting authority [(LEA)]. 

19. (AMENDED) A system according to claim 18, wherein said second network 
element corresponds to said interception gateway element [(LIG)]. 
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20. (AMENDED) A system according to claim 18 [or 19], wherein said first network 
element [(LIN)] further comprises an encrypting means [(12)] for encrypting said 
intercepted data packet. 

21 . (AMENDED) A system according to [any one of] claim[s] 1 8 [to 20], wherein 
said first network element [(LIN)] further comprises a means [(13)] for generating fake 
packets to be transmitted with said intercepted data packets. 

22. (AMENDED) A system according to [anyone of] claim[s] 18 [to 21], wherein said 
first network element [(LIN)] comprises a reading means [(11)] for reading a header of 
a received data packet and for duplicating a data packet to be intercepted. 

23. (AMENDED) A system according to claim 22, wherein said reading means 
[(11)] is arranged to pad said copied data packet to a maximum length. 

24. (AMENDED) A system according to [anyone of] claim[s] 1 8 [to 23], wherein said 
first network element [(LIN)] is a gateway element of said packet network. 

25. (AMENDED) A system according to [any one of] claim[s] 18 [to 23], wherein 
said first network element [(LIN)] is a BG, an SGSN or a GGSN. 
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26. (AMENDED) A system according to claim 24 [or 25], wherein an interception 
information defining a data packet to be intercepted is included in a context information 
supplied to said first network element [(LIN)] and used for routing data packets. 

27. (AMENDED) A system according to claim 26, wherein said interception control 
means [(26)] comprises a storing means for storing an interception list, and wherein 
said interception control means [(26)] is arranged to add said interception information 
to said context information supplied to said first network element. 

28. (AMENDED) A system according to [any one of] claim[s] 18 [to 27], wherein 
said first network element [(LIN)] is arranged in each segment of said packet network. 

29. (AMENDED) A system according to [anyone of] claim[s] 18 [to 28], wherein said 
first network element [(LIN)] comprises a control means [(15)] for controlling 
interception and encryption processing in accordance with an interception setting 
instruction received from said interception control means [(26)]. 

30. (AMENDED) A system according to [anyone of] claim[s] 18 [to 29], wherein said 
interception gateway element [(LIG)] comprises a memory means [(25)] for storing 
received intercepted data packets before supplying them to said interface means 
[(27)]. 

31 . (AMENDED) A system according to claim 30, wherein said interception 
gateway element [(LIG)] comprises a decryption means [(22)] for removing an 
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encryption of the received intercepted data packets, an extraction means [(23)] for 
extracting intercepted data packets from fake data packets, and a means [(24)] for 
adding a time information to said received intercepted data packets before storing 
them in said memory means [(25)]. 

32. (AlVIENDED) A system according to [any one of] claim[s] 18 [to 31], wherein 
said first network element [(LIN)] comprises a detecting means for detecting a 
malfunction and/or breakage thereof, and signaling means for signaling an alarm to 
said interception gateway element [(LIG)] in response to an output of said detecting 
means. 

33. (AMENDED) A network element for a packet network, comprising: 

a) an interception means [(11, 15)] for intercepting a data packet received from 
said packet network, and 

b) a transmitting means [(14)] for transmitting said intercepted data packet via said 
packet network to an interception gateway element, 

c) wherein said interception means is controlled by an interception control means 
[(26)] arranged in another network element [(LIG)]. 

34. (AMENDED) An interception gateway element for an interception system of a 
packet network, comprising: 

a) a receiving means [(21)] for receiving an intercepted data packet via said 

packet network from a network element [(LIN)] having an interception function; 
and 



an interface means [(27)] for providing an interface to an intercepting autfiority 
[(LEA)]. 



(AMENDED) An interception gateway element according to claim 34, further 
comprising an interception control means [(26)] for controlling said interception 
function of said network element [(LIN)]. 
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